Consulting Architect (Security. EMEA / Public Sector Eligible)

Elastic; Berlin; Hybrid; EUR 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

Fully paid health coverage

Flexible location and schedule

Generous vacation days

Parental leave

Volunteer time

Charitable matching

Zusammenfassung

Elastic is seeking a Consulting Architect to lead hands-on delivery of Elastic Security projects, including greenfield deployments and migrations from legacy SIEM/EDR. You will design security architectures, develop detection content, and mentor a distributed team across engagements.

Travel up to 60% and hybrid onsite work are expected as you partner with Security, Engineering and Sales to meet customer needs and security goals.

Qualifikationen

• Minimum 5 years of experience in Consulting Architect or senior IT leadership roles, delivering professional services in security.
• Solid experience deploying Elastic Security or comparable SIEM/EDR platforms.
• Strong proficiency in English and local market language.

Aufgaben

• Lead hands-on delivery of Elastic Security projects end-to-end, including greenfield deployments and migrations from legacy SIEM/EDR platforms.
• Design Elastic Security solution architectures (SIEM, endpoint, cloud security) and integrate with customer ecosystems.
• Develop security content: detection rules, dashboards, and alerting workflows.
• Mentor fellow Elastic consultants and deliver enablement sessions.
• Communicate with stakeholders up to CISO level and align recommendations with security strategy.
• Drive architectural decisions and ensure projects meet SOW timelines.

Kenntnisse

Python scripting

Infrastructure as Code

CI/CD

Kubernetes

Security architecture

Stakeholder management

Cloud security

Ausbildung

Bachelor's degree in Computer Science or related field

Tools

Elastic Stack

Terraform

Git

CI/CD tooling (GitLab pipelines)

Jobbeschreibung

• Elastic Security is one of the fastest-growing parts of our business, and our customers (including government and public sector organisations) rely on our Security Solution to modernise their SOC, threat detection, and response capabilities


• You will lead the hands-on delivery of Elastic Security projects (new implementations, migrations, and use-case expansions) from discovery through architecture design and build. Along the way, you'll develop trusted relationships with senior stakeholders and work closely with our Services, Engineering and Sales teams


• Elastic is a remote-first company, but many of the projects you'll deliver might require onsite availability, making the role hybrid in practice, varying by project, with travel of up to 60%


• Some of these engagements, given the organisations involved, also require national security screening or clearance; eligibility to obtain one in your country of employment is a strong advantage, and Elastic will sponsor the process where required


• Analyse customer goals, pain points, existing architecture, and threat landscape, translating them into technical requirements


• Design Elastic Security solution architectures (SIEM, endpoint, cloud security) that integrate with the customer's wider security ecosystem


• Advise on the customer's security strategy and own the Elastic side of it, aligning recommendations through regular sessions with senior and key stakeholders


• Lead hands-on delivery of Elastic Security projects end-to-end, including greenfield deployments and migrations from legacy SIEM/EDR platforms in mission-critical environments


• Deploy and secure the Elastic platform: cluster architecture, RBAC and role mapping, single sign-on, private connectivity (private links, VPC peering), and hardening for enterprise and government environments


• Architect and build large-scale data ingestion with Elastic Agent, Beats, and Logstash, normalising data to ECS and integrating sources such as Kafka, Azure Event Hub, and AWS S3


• Develop security content aligned to the customer's threat landscape: detection rules, dashboards, and alerting workflows


• Drive security migrations from competing platforms, applying deep knowledge of Elastic's capabilities to translate each use case into its best form, whether through feature parity mapping or full redesign


• Establish detection-as-code practices for customers managing detections programmatically: developing, testing, versioning, and deploying detection content with Python, Git, and CI/CD pipelines


• Apply and enable Elastic's Agentic AI capabilities (AI Assistant, Attack Discovery, agent-driven workflows) to accelerate customers' detection and response


• Identify and deliver new security use cases as customers mature their cyber defence journey with Elastic


• Deliver engagements on time and within the agreed Statement of Work (SOW) scope, surfacing opportunities for follow-on work


• Communicate confidently with stakeholders from SOC engineers up to CISO / C-suite level


• Partner with Elastic Sales and pre-sales to assess technical risks and shape opportunities


• Feed field insight back to Elastic Engineering, Product Management, and Support to drive feature enhancements


• Mentor and share knowledge with fellow Elastic consultants across a highly distributed team


• Lead or assist with demos and proof-of-concepts that showcase the value of the Elastic Stack, and deliver enablement sessions and hands-on workshops that make customer teams self-sufficient

Benefits

• Toast to your health: Fully paid health coverage for you and your family, in many locations.


• Craft your calendar: Flexible location and schedule for most roles.


• Create space for you: Distributed by design workforce, plus generous number of vacation days each year.


• Embrace parenthood: Minimum of 16 weeks of parental leave, plus generous family formation benefits.


• Give back your time: 40 hours each year to use toward volunteering with organizations and causes you’re passionate about.


• Amplify your impact: Double your charitable giving - we match donations up to $1500 USD (or local currency equivalent).

Scripting skills, ideally in Python, and exposure to modern delivery practices such as Infrastructure-as-Code and CI/CD are strongly preferredWillingness to travel and work onsite with customers (up to 60% of the time), combined with comfort working remotely in a highly distributed teamStrong customer advocacy, relationship-building, and communication skills, with the ability to pivot easily between delivery and strategic engagementsEligibility to obtain national security clearance in your country of employment (screening sponsored by Elastic where required)An architect’s view of the security ecosystem across varied customer environments: SOAR, vulnerability management, penetration testing, ticketing, and security policies, and how they connect in a SOCHands-on experience with Linux and Windows operating systems, and on-prem and/or public cloud platforms (AWS, Azure, GCP)Minimum of 5 years’ experience as a Consulting Architect, Senior Consultant, or in a senior IT technical leadership role, delivering and executing professional services engagements, ideally in the security domainSolid experience deploying Elastic Security or comparable SIEM platforms (e.g., Splunk, MS Sentinel, QRadar, ArcSight) and/or EDR platforms (e.g., CrowdStrike, MS Defender), or at least 2 years as a Security Analyst / Detection Engineer in a threat detection and response roleStrong proficiency in both English (our company-wide operating language) and the local market languageExperience with advanced Elasticsearch operations: cluster architecture, shard management, data ingestion, and data tiering at scaleExperience with detection-as-code: authoring, testing, and versioning detection content managed in GitExperience automating deployments and lifecycle management with Python, Terraform, and CI/CD tooling (e.g., GitLab pipelines)Experience deploying and operating containerised workloads on Kubernetes, cloud-managed or self-hosted (EKS, AKS, GKE, OpenShift)Experience as a Tier-2/Tier-3 SOC Analyst, Threat Hunter, or DevSecOps EngineerExperience with Agentic AI and LLM-based security workflows: AI assistants, automated triage, and agent-driven investigationExperience in large distributed environments or MSSPs, from architecture through deploymentElastic Certified Engineer certification, or security certifications such as GIAC or CISSPExperience delivering enablement sessions, technical workshops, or product training to technical audiences